feat: native extension install UX + VirusTotal pre-install hash scanner

[JasonWilder117]

Overview

This PR contains two independent improvements to extension handling on Android Helium Browser:

1. Streamlined native extension install — eliminates the manual Desktop site workaround
2. VirusTotal pre-install hash scanner — privacy-preserving security scan before any CRX installs

Both are additive and can be reviewed/accepted independently if preferred.

---

Feature 1 — Native Extension Install UX

Problem

Extension installation previously required a manual workaround: the user had to switch to Desktop site mode before the Chrome Web Store would present the install button. This was a 3-4 step friction point for every new extension install.

Fix (build.sh +251 lines)

Four coordinated patches that make the CWS treat the Android browser as a fully capable desktop-class extension host:

1. User-Agent spoofing — Overrides the Android UA with a desktop Chrome UA when the CWS is loaded, so the store presents the full install UI instead of the mobile "not supported" gate
2. Toolbar inflate — Ensures the Extensions toolbar entry is inflated and visible on Android so users can manage installed extensions after install
3. ExtensionsToolbarCoordinator — Wires up the coordinator previously only initialized on desktop builds, enabling the extensions icon and popup on Android
4. CWS JavaScript gate suppression — Suppresses the JS-side platform check in the Chrome Web Store that blocks installs on non-desktop user agents

Before vs After

	Before	After
Install method	Manual: enable Desktop site → navigate to CWS → install	Native: navigate to CWS → install directly
User steps	3–4 extra steps	0 extra steps
Extensions toolbar	Hidden / not inflated	Visible and functional
CWS platform check	Blocked on Android UA	Suppressed (CWS-scoped only)

README.md (+17 / -6)

• Removes the old manual "switch to Desktop site" workaround instructions
• Updates install documentation to reflect native install works out of the box

---

Feature 2 — VirusTotal Pre-Install Hash Scanner

Problem

There is no security check on CRX files before they are unpacked and installed. Extension-based malware is a common attack vector on Android Chromium browsers.

Fix (4 new files — all additive, no existing files modified)

A lightweight scan that runs before any CRX is unpacked. Only the SHA-256 hash of the extension file is transmitted — no file content ever leaves the device.

File	Purpose
patches/helium/core/add-extension-virustotal-scan.patch	Git patch targeting CrxInstaller
chrome/browser/extensions/vt_extension_scanner.h	C++ header — VtRiskLevel enum, VtScanResult struct
chrome/browser/extensions/vt_extension_scanner.cc	C++ implementation — hashing, cache, VT API query
android/java/src/org/chromium/chrome/browser/extensions/VtExtensionScanner.java	Android JNI bridge — HTTPS GET with 3s timeout

Scan Outcome Logic

Detections	Outcome
0	Silent green toast, install proceeds
1–2	Yellow warning dialog, user may proceed
3+	Red block dialog, requires explicit user override
Hash unknown to VT	Soft "unanalyzed" notice, proceeds
Timeout / no API key	Silent fail-open, install proceeds normally

Privacy & Safety Design

• Only the SHA-256 hash (32 bytes) sent over HTTPS — no file content, no user identity, no device ID
• Fully disabled by default — requires helium_vt_api_key GN build arg. Without a key every install is silent fail-open
• Results cached locally in profile prefs for 7 days — never retransmitted
• 3-second network timeout with fail-open — VT being unavailable never blocks a legitimate install
• Force-installed enterprise policy extensions bypass the scan intentionally

Build Integration Required (one-time)

1. Apply patch: git apply patches/helium/core/add-extension-virustotal-scan.patch
2. Add to chrome/browser/extensions/BUILD.gn: vt_extension_scanner.cc / .h
3. Register pref in browser_prefs.cc: registry->RegisterDictionaryPref("helium.vt_scan_cache");
4. Add Java source to build targets
5. Set API key at build time: helium_vt_api_key = "YOUR_KEY" in args.gn

A free VirusTotal API key supports 4 lookups/minute — well within typical extension install usage.

---

Happy to split these into separate PRs, adjust thresholds, or provide any additional detail based on feedback.

[jqssun]

Hey thanks for the PR! Liked the Desktop UA patch for web store. We aim to stay lightweight with strictly zero telemetry so not so sure about the VT stuff. Will have a look in greater detail over the weekend

[yongyuandisheng-BDSM]

The icon is too ugly, please change it to a nicer, more colorful icon.

[stilic]

Hey thanks for the PR! Liked the Desktop UA patch for web store. We aim to stay lightweight with strictly zero telemetry so not so sure about the VT stuff. Will have a look in greater detail over the weekend

The PR clearly looks vibe-coded, so I wouldn't recommend it to be merge as-is.

[ghost]

Heya, I have question, would be possible to implement custom search engine and wallpaper like on firefox based android apk, or is it just works diffrently on chrome android?

[jqssun]

Both are supported (via extensions). We also rolled out mv2 and dev tools support last week. A future update should allow you to edit search engines.

[NENO756]

Hello dev i want to say a bug,

There a small bug with extension icon in search bar

when disable the extension icon in toolbar, still appears when open the browser again even the option is enabled,
Here's a video
https://files.catbox.moe/57tzzs.mp4 ( my github upload is broke, sorry )

It's not a big problem, but it needs to be fixed

I also recommend enabling extensions from the extension menu, because pinned more extension you have in toolbar, the search bar be smaller and smaller
and needs to landscape the phone to search

[jqssun]

@NENO756 Ah thank you so much for noticing, this will be fixed in next update! Also feel free to switch to uBlock Origin (mv2) now that it's supported

[NENO756]

@NENO756 Ah thank you so much for noticing, this will be fixed in next update!

i edit my comment for the recommend
Sorry, I made a typo if you didn't understand

[jqssun]

@NENO756 No worries! Just pushed an update here. Should be fixed now.

[f01113170243-a11y]

Dear Developer
the google translation function is not working in the latest version 149.0.7827.22-1779489701

[whxxyu]

Hi Helium Developer,

First of all, thank you for releasing Helium on Android. I really appreciate your work on this project.

I have a small feature request, similar to what others have mentioned regarding extensions. It would be great if, in a future update, we could use extensions without having to pin them to the toolbar.

Thank you for your time and consideration.

[jqssun]

@whxxyu Ah I got what you mean! Yeah this definitely should come in a future update. There is currently some progress on this from upstream but can add it myself too.

[Brocman]

Please add the option to open a custom home page by default in a new tab.

I would also be very grateful if you added an option to open a new tab by long-pressing the tab switch button, like it's done in the Kiwi browser, instead of opening the drop-down menu like it does now.

[Brocman]

As previously noted, page language translation doesn't work in the latest current version — it would be great if the developer fixed this.

I don't often need access to extensions, but other users on other platforms are complaining that you can only open an extension's menu by tapping its pinned icon on the toolbar. If you have three extensions on the toolbar, there's no space left at all. It would be nice if the developer made it possible to open an extension's menu from the browser menu — this doesn't work right now (when tapping the extension name) — and also added the ability to group extensions into a single icon button, which when tapped would open a list of extensions with the option to access each extension's menu, like it's done in the Elixir browser, for example. If the developer does this, it will be the best browser, unlike Elixir which doesn't support MV2, and the buggy Ultimatum. Sorry for writing here — the issues section is disabled.